BountyHunter Hackthebox CTF Walkthrough - XXE, Python, eval()

BoutyHunter is an easy Linux machine by Hackthebox. The website contains a form that uses XML to submit data on the backend, we perform an XML External Entity attack to leak credentials and get a foothold on the box. We are allowed to run a specific Python script as sudo, the script uses an eval() function and by crafting a functional payload we are able to use it to spawn a new bash shell as root. TIMESTAMPS 00:00 Introduction 00:33 nmap 01:03 Website 01:27 Intercept request in BURP 02:01 XML External Entity Attack - /etc/passwd 03:16 Directory enumeration with Gobuster 04:03 XML External Entity Attack - db.php 04:51 SSH to get access on the box 05:06 Allowable sudo commands 05:16 Review code 07:19 eval() function 07:48 Crafting the ticket 08:36 r007 08:55 Outro Twitter: @faanross Music Cred: prod. Dhupabeats ex "HUB"

Видео BountyHunter Hackthebox CTF Walkthrough - XXE, Python, eval() автора JS Простым Языком